Processing of personal data at Oulu University Library

Data privacy notice

Data controller
University of Oulu
P.O. Box 8000, FI-90014 University of Oulu

For information regarding the registered data, please contact
Library Director Minna Abrahamsson-Sipponen

University Data Protection Officer
DPO@oulu.fi

Survey liability and contact information

Susanna Kouva susanna.kouva@oulu.fi
Ada-Maria Rantatalo ada-maria.rantatalo@oulu.fi
Kirsi Vähäkangas kirsi.vahakangas@oulu.fi

Purpose of processing personal data

The purpose of the survey is to collect Oulu University Library customer and personnel experience feedback and to provide insight on safety at the library premises. The collected feedback will then be utilized to further enhance the safer space principles in all Oulu University Library locations. As a concept, ‘safe space’ denotes feelings of security and protection, equality, and inclusivity. Additionally, it refers to an environment free of bias, discrimination and harassment, and a place where people can be confident that they will not be exposed to any kind of physical harm.

In the introduction to the survey, respondents are instructed not to provide any personal or otherwise sensitive information. The summarized results of the responses may include complete or selected parts of the answers submitted to the survey; however, all personally identifiable information provided in the answers will be removed. Respondents are also invited to enter a draw by providing their e-mail address on a separate form. The addresses will only be utilized to enable the implementation of the draw, as well as to make it possible for respondents to participate in the draw. The e-mail addresses will be stored and managed independently and will not be linked to the survey responses.

Legal basis for processing personal data

A draw to win movie tickets: Consent given by data subject, i.e. survey respondent. (GDPR, article 7)

Responding to a survey: Lawful grounds for processing personal data: The processing is necessary for the performance of a task carried out by the university in the public interest (GDPR, article 6, paragraph 1e).

According to the Universities Act the mission of the University of Oulu is to promote independent academic research as well as academic and artistic education, to provide research-based higher education and to educate students to serve their country and humanity at large. For these purposes Oulu University Library provides services and advice. As stipulated in the Administrative Procedure Act, universities have duty to provide their customers with advice on dealing with administrative matters and respond to questions and enquiries concerning the use of their services.

Personal data to be stored, and data storage time

The stored data consists of information provided by the safer space survey respondents. The survey is conducted in a way that it does not collect the respondent's contact information or other direct personally identifiable information. The respondents who wish to enter the survey draw are asked to provide their e-mail address on a separate form. The provided addresses will not be linked to the survey responses. The data will be retained for three months.

Provider of personal data

Data subject, i.e. survey respondent.

Recipients of personal data

The data will be stored on Webpropol. The data will not be transferred out of EU or EEA member states.

The data will not be gathered, transferred, or loaded into data analytics tools used for personal profiling.

Data subject rights

Right to obtain information on how personal data is processed

Right to access personal data

Right to have personal data rectified

Right to have personal data erased and ‘to be forgotten’

Right to restrict personal data processing

Right to have personal data transferred to another controller

Right to object to the processing of personal data

Right to file a complaint about the processing of personal data with the supervisory authority.

The applicability and extent of the above-mentioned rights will be considered case by case in accordance with the EU's General Data Protection Regulation, depending on, e.g., the processing basis in question. The data subject does not have the above-mentioned rights in all cases. No such information is collected about the respondents of this survey that would allow them to be identified with certainty. Consequently, the survey respondents do not have the rights mentioned above.

If you have questions about your rights, you can contact the university's data protection officer.

Withdrawal of consent

If you wish to withdraw your consent for processing your personal data, please contact susanna.kouva@oulu.fi

General description of the technical and organizational protection measures

The University as the Data Controller uses appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing and against damage or loss of personal data.

Data protection notice

Data controller
University of Oulu
P.O. Box 8000, 90014 University of Oulu

Contact person for the register
Library director Minna Abrahamsson-Sipponen

Contact details of the data protection officer
DPO@oulu.fi

Purpose of using your personal data

We use your personal data to manage your customer relationship with the lending service:

• supervision of borrowing and borrowing rights
• compilation of statistics, which do not include person level data
• sending of customer notifications
• collection of unreturned items

Lawful grounds for processing your personal data

We process your personal data on the basis of a contractual relationship for customer service purposes, which require disclosure of personal data.

Personal data and storage periods

The data stored in the register and their storage periods.

The personal data are deleted three years after the last customer transaction, if there are no unfulfilled obligations. An exception to this are the staff of the University of Oulu and Oulu University of Applied Sciences, whose data are stored for the duration of the employment relationship.

Sources of personal data

New library users: The personal data are mainly obtained from the individual herself, or, with the individual’s consent, from the student and study information registers and human resources management systems of the University of Oulu and Oulu University of Applied Sciences.

Updating of the personal data of existing library users: You can update your contact details (street address, telephone number and email address) through Oula-Finna. An exception to this are the staff of the University of Oulu and Oulu University of Applied Sciences, whose data are regularly updated from the human resources management systems of the respective organizations. The patron category of students of the University of Oulu and Oulu University of Applied Sciences is updated on the basis of information available in the student and study information registers.

If a library user cannot be reached using the contact details in the customer register, library staff may, if necessary, verify the contact details in the data systems of the University of Oulu or Oulu University of Applied Sciences, the Digital and Population Data Services Agency or other address or telephone number lookup service, based on an agreement between the library and the library user.

Recipients of personal data

The personal data are uploaded to the server of Ex Libris Ltd., which is located in Europe. Oulu University Library and Ex Libris, the supplier of the library system, have signed an agreement on the processing of personal data.

Some personal data of the library users who use the Tuudo mobile application are recorded in the data systems of Tuudo Oy (data protection notice).

Some of the personal data of the library users using the interlibrary service are transferred to the WebKake interlibrary service application.

When you pay library fees via our website some of your personal data are disclosed to Paytrail Plc.

Some personal data are disclosed to the Financial Services of the University of Oulu or OSAO in connection with the invoicing of unreturned library items.

The online library system is built on the Finna platform (data protection notice).

The data will not be transferred outside the EU or EEA.

Your rights

You can verify your personal data by logging into your Oula-Finna account. Requests to verify other data than those visible in Oula-Finna should be sent by e-mail to: kirjaamo@oulu.fi.

You have a right to request access to your personal data and to have them corrected. In certain situations you have a right to request erasure of your personal data or restriction of their processing.

You also have a right to lodge a complaint about the processing of your personal data with the Data Protection Ombudsman, contact details: https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman.

Data protection notice

Data controller
University of Oulu
P.O: Box 8000, 90014 University of Oulu

Contact person for the register
Library director Minna Abrahamsson-Sipponen

Contact details of the data protection officer
DPO@oulu.fi

Purpose of using your personal data

We use your personal data when you suggest publications for purchase by the library’s acquisitions services. The purpose of using the data is to communicate with you on matters related to the purchase of publications and to allocate the orders to the appropriate unit.

Lawful grounds for using your personal data

We process your personal data on the basis of a contractual relation for customer service purposes, and the service requires disclosure of personal data.

What personal data are processed?

Depending on the nature of the acquisition suggestion for example the following personal data are collected: name, library card code, email address, faculty or unit responsible. All data are not mandatory and in certain cases an acquisition suggestion can also be submitted anonymously.

Recipients of personal data

We disclose your personal data for invoicing purposes to the Financial Services of the University of Oulu, if a publication is purchased with funds provided by a faculty or research group.

Length of time your personal data are retained

Your personal data are retained as long as it is necessary for the acquisition process.

Sources of personal data

Your personal data are obtained from you.

Your rights

You have a right to request access to your personal data and to have them corrected. In certain situations you have a right to request erasure of your personal data or restriction of their processing.

Requests for verification of personal data should be submitted by email to: kirjaamo@oulu.fi.

You also have a right to lodge a complaint about the processing of your personal data with the Data Protection Ombudsman, contact details: https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman

Library’s interlibrary service

Data protection notice

Data controller
University of Oulu
P.O. Box 8000, 90014 University of Oulu

Contact person for the register
Library director Minna Abrahamsson-Sipponen

Contact details of the data protection officer
DPO@oulu.fi

Purpose of using your personal data

We process your personal data to manage your customer relationship with the interlibrary service, and to communicate with you on matters related to interlibrary service.

Lawful grounds for processing your personal data

We process your personal data on the basis of a contractual relation for customer service purposes, and the service requires disclosure of personal data.

What personal data are processed?

The following personal data are collected: name, address, telephone number, email address and library card number.

Recipients of personal data

Your personal data are entered into the WebKake interlibrary service application, whose server is located in Ireland.

We disclose your personal data for invoicing purposes to the Financial Services of the University of Oulu. The data will not be transferred outside the EU or EEA.

Length of time your personal data are retained

Your personal data and request history will be deleted 6 years after the last customer transaction, if you do not have any unfulfilled obligations. Messages sent via WebKake are retained for two months.

Sources of personal data

Your personal data are obtained from you or from the library system.

Your rights

You have a right to request access to your personal data and to have them corrected. In certain situations you have a right to request erasure of your personal data or restriction of their processing.

Requests for verification of personal data should be submitted by email to: kirjaamo@oulu.fi.

You also have a right to lodge a complaint about the processing of your personal data with the Data Protection Ombudsman, contact details: https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman

Data protection notice

Data controller
University of Oulu
P.O. Box 8000, 90014 University of Oulu

Contact person for the register
Library director Minna Abrahamsson-Sipponen

Contact details of the data protection officer
DPO@oulu.fi

Purpose of using your personal data

• The research information system contains information on the scientific and artistic activity of the staff of the University of Oulu and researchers otherwise affiliated to the university (scholarship researchers, postgraduate students etc.). The activity includes publications, expert tasks, teaching merits and international visits.
• The research information system is used to generate both statistical reports for the evaluation and development of the activity of the university and its units, as well as data for external reporting needs (e.g. the publication data collection of the Ministry of Education and Culture).
• The university compiles statistics based on the data contained in the system and analyses the data, for the purpose of evaluating and developing research activity.
• The research information system is used to showcase the university’s activity and to disseminate information to national information portals maintained by the Ministry of Education and Culture.

Lawful grounds for processing your personal data

The processing of personal data is based on the legal obligation stipulated in the EU General Data Protection Regulation (EU 2016/679): The university must provide the Ministry of Education and Culture with the data necessary for the evaluation, development, statistics, and other supervision and steering of education and research (Universities Act 558/2009, Section 51). In accordance with public interest the university also processes, compiles statistics on and analyses the data associated with its research activity and societal interaction to fulfill the duties stipulated in the Universities Act (558/2009, Section 2).

What personal data are processed?

Mandatory personal data: Name, research unit, position, duration of employment, employee identifier, areas of expertise. Voluntary: ORCID identifier, gender, academic degree, year of graduation, main subject, secondary subject, language skills, department/discipline, docentship, field of research, photograph

The data included in the expert profiles are

• publications
• expert tasks
• teaching merits
• international visits
• artistic activity
• conferences organised by the University of Oulu

Recipients of personal data

The research information system is integrated with the data repository and reporting system of the University of Oulu, which get the publication data from the research information system. The publication data are submitted to the Ministry of Education and Culture via the publication information service VIRTA and from there further to the OpenAIRE portal. Statistical data on international visits are also submitted to the Ministry of Education and Culture.

The research information system can generate lists of publications and other output in the form of RSS feeds, which can be published on any website.

The data will not be transferred outside the EU or EEA, but the Oulun yliopisto tutkii research information system is openly accessible with a web browser. If you wish, you can hide your researcher profile from public view.

Length of time personal data are retained

The length of time the personal data are retained is not limited.

Sources of personal data

The individuals themselves, University of Oulu human resources management system, register of non-University of Oulu (UFO) user identifiers, student and study information register Peppi, reference databases (e.g. Web of Science, Scopus, ARTO)

Your rights

You can verify that your publicly available personal data are correct via the system’s online user interface. Requests to verify other than publicly available information should be sent by e-mail to: kirjaamo@oulu.fi.

You have a right to request access to your personal data and to have them corrected.

In certain situations you have a right to request erasure of your personal data or restriction of their processing, or to object to their processing.

You also have a right to lodge a complaint about the processing of your personal data with the Data Protection Ombudsman, contact details: https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman

Data protection notice

Data controller
University of Oulu
P.O. Box 8000, 90014 University of Oulu

Contact person for the register
Library director Minna Abrahamsson-Sipponen

Contact details of the data protection officer
DPO@oulu.fi

Purpose of using your personal data

• The research information system contains information on the scientific and artistic activity of the staff of the University of Oulu and researchers otherwise affiliated to the university (scholarship researchers, postgraduate students etc.). The activity includes publications and other research activities.
• The data on research activity are public, with the exception of data separately agreed upon with the funder.
• The research information system is used to generate both statistical reports for the evaluation and development of the activity of the university and its units, as well as data for external reporting needs (e.g. the publication data collection of the Ministry of Education and Culture).
• The university compiles statistics based on the data contained in the system and analyses the data for the purpose of evaluating and developing research activity.
• The research information system is used to showcase the university’s activity and to disseminate information to national information portals maintained by the Ministry of Education and Culture.

Lawful grounds for processing your personal data

The processing of personal data is based on the legal obligation stipulated in the EU General Data Protection Regulation (EU 2016/679): The university must provide the Ministry of Education and Culture with the data necessary for the evaluation, development, statistics and other supervision and steering of education and research (Universities Act 558/2009, Section 51). In accordance with public interest the university also processes, compiles statistics on and analyses the data associated with its research activity and societal interaction to fulfill the duties stipulated in the Universities Act (558/2009, Section 2).

What personal data are processed?

Mandatory personal data: Name, research unit, telephone number, e-mail address, title, duration of employment, employee identifier.

Voluntary: Previous name, academic degree, ORCID identifier, fields of research and art, language skills, website address, LinkedIn and ResearchGate profile addresses, areas of expertise, photograph.

The public visibility of the telephone number and e-mail address can be restricted.

The data included in the expert profiles are

• publications
• international visits and hosting of visits
• other research activities
• conferences organised by the University of Oulu

Recipients of personal data

The personal data are stored on the server of Solenovo, the system provider of the OuluCRIS system.

The OuluCRIS research information system is integrated with the data repository and reporting system of the University of Oulu, which get the publication and research activity data from the research information system.

The data on international visits are disclosed to the KOTA data collection of the Finnish Ministry of Education and Culture/Finnish National Agency for Education.

The research information system can generate, via an application programming interface, lists of publications and other output, which can be published on any website

The data are further submitted to the Research Information Hub of the Ministry of Education and Culture (Research Information Hub Act 1238/2021, sections 3 and 4; metadata and abstracts on publications and other research outputs, metadata and descriptions of research materials, metadata on research infrastructures and research actors, metadata and abstracts on research projects and research funding, information about researchers and their other research activities and merits). The processing of personal data is based on the legal obligation to which the controller is subject (Article 6(1) (c) of the EU General Data Protection Regulation). Privacy policy of the Research Information Hub: https://research.fi/en/privacy

From the Research Information Hub the data are further submitted to the Open AIRE portal and the OpenAPC service.

The data will not be transferred outside the EU or EEA, but the public OuluCRIS research information system is openly accessible with a web browser. If you wish, you can hide your researcher profile from public view.

Personal data retention period

The personal data retention period is not restricted, because the data are needed for both scientific research, statistical purposes and evaluation of the university’s activity.

Sources of personal data

The individuals themselves, University of Oulu human resources management system, University of Oulu student and study information register, citation databases (e.g. Web of Science, Scopus, Arto, Medic, Journal.fi, PubMed).

Your rights

You can verify that your publicly available personal data are correct via the system’s online user interface. Requests to verify other than publicly available information should be sent by e-mail to: kirjaamo@oulu.fi.

You have a right to request access to your personal data and to have them corrected.

In certain situations you have a right to request erasure of your personal data or restriction of their processing, or to object to their processing. Author data for publications published by the University of Oulu are retained permanently.

You also have a right to lodge a complaint about the processing of your personal data with the Data Protection Ombudsman, contact details: https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman

Data protection notice

Data controller
University of Oulu
P.O: Box 8000, 90014 University of Oulu

Contact person for the register
Library director Minna Abrahamsson-Sipponen

Contact details of the data protection officer
DPO@oulu.fi

Purpose and lawful grounds for processing your personal data

In accordance with the principles of open science the publication repository publishes and distributes publications of the university and related data in real time to national and international open access publication portals (e.g. Finna, OpenAire, BASE, NDLTD).

The processing of your personal data is based on article 6, section 1e of the EU General Data Protection Regulation; the processing is necessary for the performance of a task carried out in the public interest.

In accordance with public interest the university also processes, compiles statistics on, analyses and publishes data associated with its research activity and societal interaction to fulfill the duties stipulated in the Universities Act (558/2009, Section 2). The data on research activity are public, and the university uses them to communicate information about its research activity in accordance with good scientific practice. According to Section 20 of the Act on the Openness of Government Activities the university shall promote the openness of its activity and see to it that the documents or the pertinent indexes which are essential to the general public’s access to information are available for example in public data networks.

Types of personal data processed

Personal name and its different versions, personal identifiers in the university’s information systems and international researcher identifiers, unit information. The information linked to persons in the repository are publications, projects, funding, and research data.

Regular sources of information

Research information system OuluCRIS

Thesis process management system Laturi

Processing and protection of sensitive personal data

No sensitive personal data are processed.

Length of time personal data are retained and erasure of unnecessary personal data

The personal data included in the material stored in the repository are retained permanently.

Automated processing and profiling of personal data

The data are not used for profiling. The processing does not involve automated decision-making.

Regular disclosure of data

The data are published in the publication repository https://oulurepo.oulu.fi, where they are publicly available, through various interfaces (RSS, OAI-PMH), to create publication, person and project lists on any website.

Transfer of data outside the EU and EEA

The personal data included in the publications are published in the repository, where they are publicly available for reading anywhere in the world.

Register protection principles

The software and hardware system of the publication repository is administered by the National Library of Finland. Oulu University Library has signed an agreement with the National Library of Finland on the processing of personal data.

The University of Oulu is responsible for the contents of its publication repository, such as the entry and management of data. System administrators at Oulu University Library have the right to process the personal data.

The personal data are published in the publication repository, where they are publicly available for reading.

Your rights

The personal data included in the publication repository are retained permanently.
You have a right to request access to your personal data and to have them corrected. In certain situations you have a right to request erasure of your personal data or restriction of their processing.

Requests for verification of personal data should be submitted by email to: kirjaamo@oulu.fi

You also have a right to lodge a complaint about the processing of your personal data with the Data Protection Ombudsman, contact details: https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman

Data protection notice

Data controller
University of Oulu
P.O. Box 8000, 90014 University of Oulu

Contact person for the register
Library director Minna Abrahamsson-Sipponen

Contact details of the data protection officer
DPO@oulu.fi

Purpose of using your personal data

The Oulu University Library chat service provides personal advice and instructions on library-related matters. The questions asked in chat are answered by a member of a team of experts in the library. Each expert has a personal user account for the service.

You can use the chat anonymously and you do not have to be a library user to use the service. If your question concerns for example making reservations or renewing your loans, you will have to provide identification, such as your library card number.

The expert may start a Zoom online meeting from chat if you agree to it. The meetings are not recorded.

If the expert is unable to answer your question during the chat discussion, she may create an advice-related ticket in the chat backend service. Your contact information is included in the ticket, so that the expert will be able to contact you when she can give an answer to your question. A ticket is also created when an expert is not present in the chat service and the customer leaves a question and her contact information in the chat.

All chat discussions are recorded to ensure the quality of advice and correctness of answers given to customers. The recordings may be used in training aimed at improving customer service and in the development of the service. Anonymised chat discussions are also used for statistical purposes.

Lawful grounds for processing your personal data

Lawful grounds for processing personal data: The processing is necessary for the performance of a task carried out by the university in the public interest (GDPR, article 6, paragraph 1e).

According to the Universities Act the mission of the University of Oulu is to promote independent academic research as well as academic and artistic education, to provide research-based higher education and to educate students to serve their country and humanity at large. For these purposes Oulu University Library provides services and advice. As stipulated in the Administrative Procedure Act, universities have duty to provide their customers with advice on dealing with administrative matters and respond to questions and enquiries concerning the use of their services.

Personal data and retention periods

The recorded data consist of the information provided by the customer, recorded discussion and identifiers automatically generated by the system.

Data recorded in the chat discussion

• Exchange of messages between customer and expert and its time
• Name or nickname given by the customer. If the information is missing, the system generates a user identifier.
• E-mail address provided by the customer. Non-mandatory information.
• Initial question asked by the customer.
• Customer’s IP address, browser, browser’s user agent, operating system
• Page where the chat was launched from and the chat service window’s identifier
• Team processing the chat service request
• Expert’s name
• Time when chatting started, wait time, chatting duration, message count
• Internal comment added to the chat by the expert
• Tags added by the expert
• Service ticket identifier, if the expert has created an advice request based on the chat

Data retention period: 3 months

Advice request (ticket) includes

• Team or expert processing the request
• Customer’s name or nickname. If the information is missing, the system generates a user identifier.
• Customer’s e-mail address
• Internal comment on the advice request
• Chat discussion between the customer and the expert and its time
• Reply sent to the customer and possible attached file
• Customer’s reply to the advice request
• Tags added by the expert

Data retention period: 3 months

The customer’s personal data and the exchange of messages between the customer and the expert are automatically deleted from chat discussions and advice requests after 3 months.

Sources of personal data

The individuals themselves: Information given by the person to the customer service person during the chat discussion.

If the customer’s question concerns her customer relationship with the library or her studies, the library staff may, if necessary, verify information in University of Oulu or Oulu University of Applied Sciences information systems.

Recipients of personal data

The personal data are stored on the server of Springshare, the provider of the chat service, which is located in Europe. Data protection notice: https://springshare.com/privacy.html and GDPR compliance: https://springshare.com/gdpr.html.

Your data will not be transferred outside the EU or EEA.

Your rights

You have the right to request access to your personal data and to have them corrected. In certain situations you also have a right to request erasure of your personal data.

Requests by e-mail to: kirjaamo@oulu.fi.

You also have a right to lodge a complaint about the processing of your personal data with the Data Protection Ombudsman, contact details: https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman.

Last updated 20.1.2023